There are typically quite a few steps between initial access and domain domination, which I assume is what they ended up with, considering they have administrator account passwords. Well, unless you are using 123456 as the password for an admin account.